---
title: "What is the difference between the functions signData and signHash?"
description: "Difference between the Web PKI functions signData and signHash, explained through the four steps of the RSA signature algorithm."
canonical: "https://docs.lacunasoftware.com/en-us/articles/web-pki/faq/sign-data-vs-hash"
locale: "en"
product: "Web PKI"
last_updated: "2026-10-12"
---

# What is the difference between the functions signData and signHash?

Both functions -- `signData` and `signHash` -- run a digital signature algorithm with the private key of
one of the certificates on the user's computer. To understand the difference between the two functions, we need to talk
briefly about the details of a signature algorithm.

> **Note**
>
> The term *digital signature* ***algorithm*** should not be confused with *digital signature*. Read more about
> this subject in the article [Digital signatures](https://docs.lacunasoftware.com/en-us/articles/pki-guide/signatures).

The RSA algorithm, broadly speaking, has 4 steps:

1. Computing the hash of the bytes to be signed
1. Encoding the [DigestInfo](https://tools.ietf.org/html/rfc2313#section-10.1.2) structure, which contains the hash and the OID of the hash algorithm used to produce it
1. *Padding* the encoded DigestInfo
1. A mathematical operation on the encoded and *padded* DigestInfo

> **Note**
>
> The hash computed in the first step is usually **not the hash of the document being signed**. In the CMS/CAdES, PAdES and XmlDSig/XAdES signature schemes,
> the bytes used as input to the signature algorithm are the encoding of the "signed attributes", a
> structure that contains various data, among them the document hash.

The `signData` function takes the *to-sign-data* as input and performs all the steps on it, while the `signHash` function takes the *to-sign-hash*, that is, the precomputed hash of the *to-sign-data*, and performs on it
only the second step onwards.

Both functions can be used to implement [web remote signatures](https://docs.lacunasoftware.com/en-us/articles/pki-guide/web-signatures/remote)
regardless of the signature scheme (CAdES, PAdES, etc.) being used. Which function to use
depends on the *output* of the backend code at the end of the remote signature "preparation". If it produces a *to-sign-data*, use the `signData` function. If it produces a *to-sign-hash*, use the `signHash` function.

**Demos and samples**

- Sign data with RSA in the browser using Web PKI: [.NET](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/mvc/PkiSuiteAspNetMvcSample/Controllers/RSAWebController.cs) · [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/RSAWebController.java) · [Node.js](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/nodejs/expressmvc/routes/rsa-web.js) · [Python](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/python/flask/sample/views/rsa_web.py) · [Ruby](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/ruby/rails/app/controllers/rsa_web_controller.rb)